Към съдържанието
Търсене

CVE-2024-26782: Linux

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix double-free on socket dismantle when MPTCP server accepts an incoming connection, it clones its listener socket. However, the pointer to 'inet_opt' for the new socket has the same value as the original one: as a consequence, on program exit it's possible to observe the following splat: BUG: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0 Free of addr ffff888485950880 by task swapper/25/0 CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 6.8.0-rc1+ #609 Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0 07/26/2013 Call Trace: <IRQ> dump_stack_lvl+0x32/0x50 print_report+0xca/0x620 kasan_report_invalid_free+0x64/0x90 __kasan_slab_free+0x1aa/0x1f0 kfree+0xed/0x2e0 inet_sock_destruct+0x54f/0x8b0 __sk_destruct+0x48/0x5b0 rcu_do_batch+0x34e/0xd90 rcu_core+0x559/0xac0 __do_softirq+0x183/0x5a4 irq_exit_rcu+0x12d/0x170 sysvec_apic_timer_interrupt+0x6b/0x80 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x16/0x20 RIP: 0010:cpuidle_enter_state+0x175/0x300 Code: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed <0f> 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffff88887facddc8 RCX: 0000000000000000 RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588 RBP: 0000000000000004 R08: 0000000000000002 R09: 0000000000043080 R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0 R13: 0000000000000004 R14: 0000000000000000 R15: 00000022c880ec80 cpuidle_enter+0x4a/0xa0 do_idle+0x310/0x410 cpu_startup_entry+0x51/0x60 start_secondary+0x211/0x270 secondary_startup_64_no_verify+0x184/0x18b </TASK> Allocated by task 6853: kasan_save_stack+0x1c/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0xa

Засегнати продукти

  • Linux Linux: cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be преди f74362a004225df935863dea6eb7d82daaa5b16e; cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be преди 4a4eeb6912538c2d0b158e8d11b62d96c1dada4e; cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be преди d93fd40c62397326046902a2c5cb75af50882a85; cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be преди ce0809ada38dca8d6d41bb57ab40494855c30582; cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be преди 85933e80d077c9ae2227226beb86c22f464059cc; cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be преди 10048689def7e40a4405acda16fdc6477d4ecc5c
  • Linux Linux: 5.6; преди 5.6; 5.10.212 до 5.10.*; 5.15.151 до 5.15.*; 6.1.81 до 6.1.*; 6.6.21 до 6.6.*; 6.7.9 до 6.7.*; 6.8 до *

История

  • 4 април 2024 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2024-26782: Linux | freedomonline.bg